# Threat Intel Brief — October 22, 2026

TL;DR

  • PHP2Shell RCE vulnerabilities (CVE-2026-109618, CVE-2026-109619) affect all PHP versions since 2014; active exploitation observed, emergency patches released October 21.
  • Supply chain attacks compromised LiteLLM Python package, eMudhra certificate authority private keys, and ConnectWise via AI-accelerated nation-state campaign.
  • SafePay ransomware breached over 600 critical infrastructure organizations globally since August 2024, filling void left by disrupted RaaS operations.
  • APT28 (Russia) and Storm-0940 (China) conducted espionage operations against NATO shipbuilders and cloud service providers respectively.
  • GitLab CVSS 10.0 RCE (CVE-2026-110264) affects all self-managed instances from 2014 onward; patches released October 21.

Critical Threats

PHP2Shell Remote Code Execution

What happened: Two critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) enable unauthenticated remote code execution on web servers running any PHP version from PHP 5 onward. The flaws exploit memory corruption in out-of-memory error handling and fatal error processing, allowing attackers to execute arbitrary code before application logic runs. Patches were released October 21 at 14:00 UTC. Active exploitation attempts were detected by Cloudflare immediately following disclosure, with working proof-of-concept exploits circulating publicly.

Impact: Approximately 5.1 million internet-facing PHP hosts are exposed, representing roughly 75-80% of all websites globally. The vulnerabilities affect all deployment modes including PHP-FPM, Apache mod_php, and php-cgi, with Apache mod_php environments facing highest immediate risk. Attackers can achieve full server compromise, install web shells for persistent access, and read sensitive data from worker memory including credentials and API keys. Several European government websites went offline as a precautionary measure. The UK NCSC and CERT-EU issued critical advisories urging immediate patching.

Recommendations:

  • Upgrade immediately to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 depending on branch; restart all PHP workers and Apache/FPM services
  • Deploy WAF rules (Cloudflare published emergency signatures) as temporary mitigation during patching window
  • If patching is impossible within 24 hours, apply incomplete mitigations: set memory_limit=-1, keep post_max_size low, set session.upload_progress.enabled=0
  • Monitor web server logs for unusual multipart requests followed by memory-limit errors, HTTP 500 bursts, and unexplained PHP worker restarts
  • Scan web directories for unauthorized PHP files and web shells; review recent file modifications and new admin accounts

LiteLLM Supply Chain Compromise

What happened: Version 1.107.0 of the LiteLLM Python package was compromised via stolen GitHub CLI OAuth tokens from three engineer accounts. Malicious code was injected into PyPI wheels (all platforms) and Docker images, delivering credential-stealing malware and a backdoor. The package was live on PyPI for several hours on October 19 before being quarantined. This is the second attack on LiteLLM in 2026, following a March campaign by the same TeamPCP threat cluster.

Impact: Organizations that installed version 1.107.0 face immediate credential exposure. The malware targets AWS, Azure, GCP credentials, private SSH keys, browser session data, AI development tool credentials, and LiteLLM proxy configurations. Stolen data was exfiltrated via HTTP POST to attacker infrastructure. The backdoor component checks a GitHub repository hourly for arbitrary Python code execution, enabling persistent remote access. The attack demonstrates sustained targeting of AI/LLM development supply chains.

Recommendations:

  • Immediately identify all systems that installed LiteLLM 1.107.0 via PyPI or Docker; isolate and treat as compromised
  • Revoke and rotate all cloud provider credentials, SSH keys, API tokens, and browser sessions on affected systems
  • Pin LiteLLM to version 1.106.2 by cryptographic digest; verify package integrity before deployment
  • Block egress connections to litellm[.]dev/healthcheck and github[.]com/letters9813; investigate any existing connections
  • Audit GitHub CLI OAuth tokens and organization access; enable mandatory 2FA and review recent repository activity

eMudhra Certificate Authority Key Compromise

What happened: Eight eMudhra intermediate CA private keys (six TLS, two code-signing) were compromised due to weak P-384 elliptic curve keys with values less than 256, making them instantly recoverable via brute force. The certificates were issued in April 2025 but the weakness was discovered October 17, 2026. Mozilla, Google, and Apple deployed emergency blocks across browsers. Go, Python certifi, Rust webpki-roots, and NSS released urgent updates.

Impact: Attackers possessing these keys can issue trusted certificates for any domain, enabling man-in-the-middle attacks, phishing, and code signing abuse. While major browsers pushed revocation blocks within hours, Go binaries, Python applications, and systems with static root bundles remain vulnerable until rebuilt or updated. Many non-browser TLS clients lack revocation checking, creating persistent exposure. The 18-month window between issuance and discovery raises concerns about potential undetected exploitation.

Recommendations:

  • Update Go to 1.27.3 or 1.26.10 (CVE-2026-111943) and rebuild all Go binaries performing TLS verification
  • Update Python certifi to 2026.10.19+, Rust webpki-roots to 1.0.10, NSS to 3.131.1, Homebrew ca-certificates to 2026-09-25_1
  • Verify Firefox 158.0.1+ and Chrome auto-updates deployed; confirm OneCRL/CRLSet blocks active
  • Audit internal applications and appliances using static root bundles; prioritize removal of emSign ECC Root CA - G3 and emSign Root TLS CA - G3
  • Monitor Certificate Transparency logs for unexpected certificates chaining to eMudhra roots from April 2025 to October 2026

GitLab Unauthenticated RCE (CVSS 10.0)

What happened: GitLab disclosed CVE-2026-110264, a critical unauthenticated remote code execution vulnerability affecting all self-managed installations from version 7.0 (released 2014) through 19.5.0. The flaw stems from an integer overflow in the Onigmo regex compiler. An earlier October 12 patch (CVE-2026-97229) only covered versions 19.2 and later, requiring administrators to apply new fixes released October 21 for complete protection.

Impact: Attackers can achieve unauthenticated RCE on self-managed GitLab servers by sending specially crafted regular expressions. The vulnerability affects 12 years of releases, creating massive exposure across government, defense, and enterprise DevOps infrastructure. Upgrades to certain versions require database migrations causing downtime on single-node deployments. GitLab.com and GitLab Dedicated tenants on internal releases are not affected.

Recommendations:

  • Upgrade all self-managed instances immediately to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, or 18.11.13 depending on current branch
  • Plan for downtime on single-node servers during upgrade to 19.4.3 or 19.3.6; use zero-downtime procedure for multi-node environments
  • Deploy GitLab TLDR Sigma detection rules ("Onigmo native worker crash" and "Org mode render error burst") to monitor for exploitation attempts
  • Review GitLab application logs retroactively using published detection rules
  • Verify GitLab.com and Dedicated tenants are on internal releases 19.3.5-internal0, 19.4.2-internal0, or later

SafePay Ransomware Campaign

What happened: CISA, FBI, U.S. Secret Service, German police, and UK National Crime Agency issued a joint advisory documenting SafePay ransomware operations against over 600 critical infrastructure organizations globally since August 2024. The group operates as a private ransomware operation without an affiliate model, filling the void left by disrupted BlackCat and LockBit operations. SafePay employs double-extortion tactics, exfiltrating data before encryption.

Impact: Victims span North America, South America, Europe, and Australia across multiple critical infrastructure sectors. The group exploits credential exposure, brute force attacks, phishing, and VPN vulnerabilities (particularly Mullvad VPN). Post-compromise, SafePay deletes shadow copies and resets network-attached storage to disrupt recovery. The targeting of essential services creates operational urgency and maximizes ransom payment pressure.

Recommendations:

  • Implement multifactor authentication across all accounts and enforce identity, credential, and access management policies
  • Prioritize patching of VPNs, firewalls, and edge devices, especially vulnerabilities in CISA's KEV catalog
  • Implement robust backup strategies with immutable or air-gapped backups to protect against shadow copy deletion and NAS resets
  • Monitor for brute force attempts, unusual VPN connections (particularly Mullvad IP ranges), and automated scanning targeting internet-exposed systems
  • Restrict administrative tool usage and enforce least-privilege access controls to limit lateral movement

Threat Actor Activity

Storm-0940 (China) — ConnectWise Supply Chain Attack

China-aligned threat actor Storm-0940 leveraged the ARTEX agentic AI framework to compromise ConnectWise in a large-scale supply chain attack affecting hundreds of organizations across aerospace, defense, government, military, semiconductor, and technology sectors. The actor achieved privileged cloud access in under three hours in multiple cases by abusing OAuth application credentials for Microsoft 365 authentication without user interaction. Active exploitation observed since September 2026. ConnectWise published containment guidance October 16; Cloud Backup service remains offline.

Defensive actions: Review service principal sign-in logs in Azure AD/Entra ID for ConnectWise applications and unexpected authentication patterns since September 2026. Audit OAuth application credentials and privilege changes; revoke and rotate credentials per ConnectWise guidance. Deploy Microsoft Defender XDR detections for suspicious Microsoft Graph activity. Implement conditional access policies restricting service principal sign-ins.

APT28 (Russia) — NATO Shipbuilder Intrusions

Russian state-sponsored APT28 breached NATO naval shipbuilders, a law enforcement agency, and a military aircraft engine manufacturer in NATO member countries, deploying the HOOKEDGE backdoor and a new reflective loader. The campaign involved sustained hands-on-keyboard activity over a week in late July 2026 at the naval shipbuilder. APT28 exploited CVE-2026-21509 (Microsoft Office security bypass) and CVE-2026-8496 (SOGo webmail zero-click vulnerability). The targeting reflects Russian intelligence priorities around NATO maritime capabilities and defense supply chains.

Defensive actions: Monitor for suspicious Microsoft Office macro execution and implement application whitelisting. Detect PowerShell-based credential theft via Sysmon Event ID 1 and 3, monitoring for scripts establishing listeners on loopback addresses. Identify unauthorized SSH tunnel establishment by monitoring for unexpected SSH private key deployments. Apply patches for CVE-2026-21509 and CVE-2026-8496 immediately.

Lazarus (North Korea) — Post-Quantum Cryptography Adoption

North Korean threat actor Lazarus deployed ML-KEM post-quantum cryptographic mechanisms in the FlashHole campaign targeting South Korean organizations across software development, construction, and telecommunications sectors since July 2025. The operation combines legacy malware (LPEClient) with new tools (ClientHub, Cubridge) and exploits INISAFE CrossWeb EX, a legitimate South Korean security tool. The use of NIST-standardized post-quantum encryption demonstrates operational security advancement to protect payloads from future quantum decryption threats.

Defensive actions: Monitor for suspicious execution of fsquirt.exe in non-standard contexts, particularly when spawned by browser processes or security software. Implement behavioral detection for JavaScript-initiated shellcode execution and in-memory payload staging. Audit and restrict access to private GitHub repositories; monitor for downloaders retrieving executables from code hosting platforms. Deploy endpoint detection for ML-KEM, GOST, and Threefish cryptographic operations in unexpected process contexts.

Bronze Sandcastle (China) — DLL Sideloading in Asia-Africa

China-aligned Bronze Sandcastle has targeted organizations in Asia and Africa since mid-2025 using Sandboxie DLL sideloading to deploy backdoors. Confirmed victims include organizations in the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea. The actor leverages eight distinct sideloading combinations including Sandboxie, Java, Krita, NVDA, and Sysinternals tools. Sideloaded DLLs decrypt and execute payloads from config.ini files, enabling in-memory shellcode execution. C2 communication occurs via file-sharing services (file.io, gofile.io, ably.net) and GitHub API.

Defensive actions: Monitor for DLL sideloading indicators: legitimate signed executables loading DLLs from non-standard paths, particularly sbiedll.dll, jli.dll, version.dll, and snmpapi.dll in user-writable directories. Detect DLLs reading local INI/config files followed by immediate in-memory execution. Implement network monitoring for C2 communication to file-sharing services and GitHub API access patterns. Enable application whitelisting and DLL search order hardening.

Geopolitical Context

U.S.-China Technology Decoupling

The Department of Homeland Security issued an order requiring federal civilian agencies to cease using DeepSeek AI products and remove them from government systems, citing concerns that the Chinese government could access DeepSeek infrastructure to collect personal information and transfer sensitive data to China. The directive reflects escalating U.S. efforts to mitigate technology supply chain risks linked to Chinese firms and extends previous restrictions on telecommunications equipment and social media platforms to artificial intelligence tools. The action signals that large language models with access to user inputs and system data are now viewed through the same national security lens as hardware and network infrastructure.

Serbian Civil Society Surveillance

Citizen Lab confirmed Pegasus spyware infection of Vladan Đokić, rector of the University of Belgrade and student protest supporter, six days before Serbia's October 25 snap parliamentary election. The targeting is part of a broader campaign affecting at least 16 Serbian civil society figures in 2026, including student activists, opposition politicians, and a prosecutor previously assigned to a corruption investigation involving a Kushner-linked Belgrade property development. Amnesty International previously reported that NoviSpy Android spyware was configured to exfiltrate data to Serbia's Security Information Agency (BIA). The incident raises concerns about rule-of-law erosion in EU candidate states and potential complications for Serbia's accession negotiations.

NATO Defense Industrial Base Targeting

APT28's intrusions against NATO naval shipbuilders and military aviation engine manufacturers demonstrate continued Russian intelligence collection priorities targeting Western military-industrial capabilities. The focus on entities holding sensitive information about alliance naval assets occurs against a backdrop of heightened NATO naval activity in the Baltic and Black Sea regions. The deployment of new tooling suggests continued investment in capabilities designed to penetrate hardened defense sector networks, with potential implications for NATO collective defense and alliance industrial security.

Recommended Actions

Immediate (0-24 hours)

  • PHP servers: Upgrade to patched versions (8.5.12, 8.4.27, 8.3.36, 8.2.35) and restart all workers; deploy WAF rules if patching delayed
  • LiteLLM users: Identify systems that installed version 1.107.0; isolate, rotate all credentials, and downgrade to 1.106.2
  • GitLab self-managed: Upgrade to fixed versions (19.5.1, 19.4.3, 19.3.6, or branch-specific patches)
  • eMudhra exposure: Update Go to 1.27.3/1.26.10, Python certifi to 2026.10.19+, and rebuild affected applications
  • ConnectWise users: Review service principal sign-ins for anomalous OAuth activity; follow ConnectWise containment guidance

24-72 hours

  • Plex Media Server: Update to version 1.43.3.10861+ to remediate Plex2Shell vulnerabilities (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656)
  • Fortinet FortiSIEM: Upgrade version 7.5.0 to 7.5.1+ to address CVE-2026-106173; block external access to TCP 27918
  • WordPress/UpdraftCentral: Update to UpdraftPlus 1.26.13/2.26.13+; manually delete UpdraftCentral connection keys and inspect for unauthorized admin accounts
  • Palo Alto PAN-OS: Patch CVE-2026-0257 on all instances; hunt for unauthorized VPN sessions and gateway-connected events
  • Certificate infrastructure: Audit internal applications for stale eMudhra certificate bundles; monitor CT logs for unexpected issuance

This week

  • AI tool security: Block execution of commands pasted from clipboard in terminal applications; restrict access to public ChatGPT custom GPTs and shared Claude Artifacts
  • Ransomware defense: Implement MFA across all accounts; prioritize VPN/firewall/edge device patching; verify backup immutability
  • Supply chain review: Audit GitHub CLI OAuth tokens; enable mandatory 2FA on code repositories; implement repository security controls
  • Threat hunting: Deploy detection rules for DLL sideloading, SSH tunnel establishment, and OAuth application credential abuse
  • Incident response: Review logs retroactively for PHP exploitation attempts, Plex2Shell indicators, and ConnectWise OAuth anomalies

Watch List

  • PHP exploitation trends: Monitor for mass scanning and ransomware deployment as PoC exploits circulate; expect sustained exploitation window for legacy systems
  • ARTEX framework adoption: Additional threat actors may adopt AI-accelerated attack capabilities; watch for similar supply chain compromises
  • ClickFix campaigns: Surge in attacks leveraging fake AI installers and malicious search results; 67% of browser-based detections in August 2026
  • Tor exit relay compromise: Over 300 relays hijacked October 1-5 to intercept SSH credentials; check for Ebury backdoor on affected systems
  • Autonomous AI agents: First documented case of AI agents deployed at scale for criminal intrusion (1,200+ sites targeted); expect proliferation
  • DeepSeek restrictions: U.S. federal ban may influence allied nations' risk assessments of Chinese AI platforms; watch for reciprocal measures

Sources

  • CISA Known Exploited Vulnerabilities Catalog
  • CERT-EU Security Advisory 2026-018
  • UK National Cyber Security Centre
  • Microsoft Security Blog (Storm-0940 analysis)
  • Palo Alto Networks Unit 42
  • Kaspersky (Lazarus FlashHole campaign)
  • Sophos (Bronze Sandcastle disclosure)
  • Symantec Threat Intelligence (APT28/Swallowtail)
  • Citizen Lab (Pegasus infection confirmation)
  • BleepingComputer, The Hacker News, Krebs on Security (vulnerability and incident reporting)

---

*This brief covers events and disclosures from October 17-22, 2026. All CVE identifiers are drawn exclusively from official advisories and vendor disclosures. Organizations should verify patch availability through vendor channels and prioritize actions based on asset exposure and risk tolerance.*